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What is claimed is : 

1 . A computer-implemented method for executing an untrusted program, 
comprising: 

establishing a limited environment, said limited environment comprising at least 
5 one mock resource; 

executing at least a portion of an untrusted program within said limited 
environment; and 

examining said limited environment after execution of at least said portion of said 
untrusted program to check for undesirable behavior exhibited by said untrusted program. 



2. The method of claim 1 , where said limited environment precludes access 
to actual resources, which if altered or accessed by said untrusted program, may lead to 
undesirable consequences. 



10 



15 



3. 



The method of claim 1, wherein said limited environment comprises a 



shell in a UNIX operating system environment. 



4. 



The method of claim 1, wherein examining said mock environment 



comprises: 
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determining whether said mock resource has been deleted. 



5. 



The method of claim 1, wherein examining said mock environment 



comprises: 
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determining whether said mock resource has been renamed. 

6. The method of claim 1 , wherein examining said mock environment 
comprises: 

determining whether said mock resource has been moved. 

7. The method of claim 1 , wherein examining said mock environment 
comprises: 

determining whether said mock resource has been altered. 

8. The method of claim 7, wherein said mock resource has a parameter 
associated therewith which changes when said mock resource is altered, and wherein 
determining whether said mock resource has been altered, comprises: 

determining whether said parameter has changed. 

9. The method of claim 8, wherein said parameter is a time value indicating 
when said mock resource was last updated. 

1 0. The method of claim 1 , wherein examining said mock environment 
comprises: 

determining whether said mock resource has been accessed. 
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1 1 . The method of claim 1 0, wherein said mock resource contains one or more 
sets of content, wherein said entrusted program executes in a particular portion of 
memory, and wherein determining whether said mock resource has been accessed 
comprises: 

searching said particular portion of said memory for at least one of said one or 
more sets of content. 

12. The method of claim 1 , further comprising: 

providing information indicating behavior exhibited by said untrusted program. 

1 3 . The method of claim 1 2, wherein said information comprises indications 
of undesirable behavior exhibited by said untrusted program. 

14. The method of claim 1 , further comprising: 

determining whether said untrusted program has exhibited undesirable behavior; 

and 

in response to a determination that said untrusted program has exhibited 
undesirable behavior, taking corrective action. 

15. The method of claim 14, wherein taking corrective action comprises: 
deleting said untrusted program. 

16. The method of claim 14, wherein taking corrective action comprises: 
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providing a warning to a user. 

17. A computer readable medium comprising instructions which, when 
executed by one or more processors, cause the one or more processors to execute an 

5 untrusted program, said computer readable medium comprising: 

instructions for causing one or more processors to establish a limited 
environment, said limited environment comprising at least one mock resource; 

instructions for causing one or more processors to execute at least a portion of an 
untrusted program within said limited environment; and 
10 instructions for causing one or more processors to examine said limited 

environment after execution of at least said portion of said untrusted program to check for 
undesirable behavior exhibited by said untrusted program. 

18. The computer readable medium of claim 17, where said limited 

15 environment precludes access to actual resources, which if altered or accessed by said 
untrusted program, may lead to undesirable consequences. 

19. The computer readable medium of claim 1 7, wherein said limited 
environment comprises a shell in a UNIX operating system environment. 

20 

20. The computer readable medium of claim 17, wherein said instructions for 
causing one or more processors to examine said mock environment comprises: 

21 



15437-0508/P5373 



instructions for causing one or more processors to determine whether said mock 
resource has been deleted. 

2 1 . The computer readable medium of claim 1 7, wherein said instructions for 
5 causing one or more processors to examine said mock environment comprises: 

instructions for causing one or more processors to determine whether said mock 
resource has been renamed. 

22. The computer readable medium of claim 1 7, wherein said instructions for 
10 causing one or more processors to examine said mock environment comprises: 

instructions for causing one or more processors to determine whether said mock 
resource has been moved. 

23. The computer readable medium of claim 1 7, wherein said instructions for 
15 causing one or more processors to examine said mock environment comprises: 

instructions for causing one or more processors to determine whether said mock 
resource has been altered. 

24. The computer readable medium of claim 23 , wherein said mock resource 
20 has a parameter associated therewith which changes when said mock resource is altered, 

and wherein said instructions for causing one or more processors to determine whether 
said mock resource has been altered, comprises: 
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instructions for causing one or more processors to determine whether said 
parameter has changed. 

25. The computer readable medium of claim 24, wherein said parameter is a 
time value indicating when said mock resource was last updated. 

26. The computer readable medium of claim 1 7, wherein said instructions for 
causing one or more processors to examine said mock environment comprises: 

instructions for causing one or more processors to determine whether said mock 
resource has been accessed. 

27. The computer readable medium of claim 26, wherein said mock resource 
contains one or more sets of content, wherein said untrusted program executes in a 
particular portion of memory, and wherein said instructions for causing one or more 
processors to determine whether said mock resource has been accessed comprises: 

instructions for causing one or more processors to search said particular portion of 
said memory for at least one of said one or more sets of content. 

28 . The computer readable medium of claim 1 7, further comprising: 
instructions for causing one or more processors to provide information indicating 

behavior exhibited by said untrusted program. 
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29. The computer readable medium of claim 28, wherein said information 
comprises indications of undesirable behavior exhibited by said untrusted program. 

30. The computer readable medium of claim 17, further comprising: 

5 instructions for causing one or more processors to determine whether said 

untrusted program has exhibited undesirable behavior; and 

instructions for causing one or more processors to, in response to a determination 
that said untrusted program has exhibited undesirable behavior, take corrective action. 

10 31. The computer readable medium of claim 30, wherein said instructions for 

causing one or more processors to take corrective action comprises: 

instructions for causing one or more processors to delete said untrusted program. 

32. The computer readable medium of claim 30, wherein said instructions for 
15 causing one or more processors to take corrective action comprises: 

instructions for causing one or more processors to provide a warning to a user. 
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